BRIEFRansomwarehighP60
LockBit ransomware publishes German healthcare supplier HyGear
HyGear (Germany)
Detected18 September 2026 · 22:12 UTC
The LockBit group has added HyGear, a German on-site and on-demand hydrogen supplier in the healthcare sector, to its extortion portal. The victim combines industrial/OT hydrogen production with healthcare supply chains, so a breach could disrupt operations and expose partner or client data. Defenders in energy and healthcare supply chains should watch for leaked credentials and follow-on access attempts.
CategoryRansomware
Severityhigh
Priority score60
Detected18 September 2026 · 22:12 UTC
Ransomware● 78
Ransomware LockBit publica a la minorista chilena ForusThe LockBit leak site has listed Forus, a Chilean apparel retailer headquartered in Santiago and founded in 1980, as a victim in the professional services sector. As a large regional company it holds customer, supplier and transaction data, so a confirmed breach could expose personal and financial information across Chile. A defender should verify the claim and monitor for leaked or traded Forus data.Ransomware● 60
Ransomware Akira publica a la fabricante Anderson IndustriesThe Akira ransomware group listed Anderson Industries, an engineering and manufacturing firm producing agricultural equipment and foundry services, and threatens to publish 9GB of corporate data including employee and client personal information, project specs, orders, financials and NDAs. The victim's country is not confirmed, but manufacturing supply chains are high-value targets and the mix of personal and financial records raises fraud and competitive-risk concerns for peers.Ransomware● 55
Ransomware Incransom publica a la editorial estadounidense Kendall HuntIncransom ransomware has published Kendall Hunt Publishing, a US K-12 educational publisher, as a victim on its leak site. Educational publishers hold student, teacher and customer data plus proprietary curricula, making the breach sensitive. The victim is outside Latin America, so priority for AR-LATAM defenders is moderate.Ransomware● 40
Ransomware Incransom publica a la operadora neerlandesa Roan CampingThe Incransom ransomware group has listed Roan Luxury Camping Holidays, a Dutch tour operator, on its leak site. A breach could expose booking and customer payment data during the active European travel season. The victim is a small business outside Latin America, so regional impact is low.Ransomware● 52
Ransomware Spirals publica a la empresa ITAD ANYTHINGITSpirals ransomware listed ANYTHINGIT, an IT asset disposition and e-waste firm serving federal agencies, defense contractors and enterprises under strict chain-of-custody requirements. The victim's role in handling sensitive federal hardware and data creates real supply-chain risk. Defenders should assess downstream exposure to any agency data passing through this provider.Ransomware● 64
Ransomware Endzone publica datos de la gubernamental AccelaEndzone published over 50 GB allegedly from Accela, a cloud platform used by US state and local governments, including 2 million lines of PII and 6 million citizen-service requests. Compromise of a government-services vendor can cascade into many public agencies that depend on it. Public-sector defenders should verify exposure and monitor Accela downstream dependencies.